OpenAI Quietly Open-Sources Codex Security CLI

OpenAI has put its Codex Security CLI on GitHub and npm, but most developers only noticed after a Hacker News post. My short take: this is not just a chat-style coding tool. It is a terminal-based security workflow that can scan repos, test if issues can be exploited, and suggest patches.

Here’s what matters most if you’re deciding whether to try it:

• What it is: an Apache-2.0 CLI and TypeScript SDK published as @openai/codex
• What it does: scans code, maps attack paths, validates findings in a sandbox, and drafts fixes
• Where it fits: local terminal use, scripts, and CI jobs
• What teams should watch: API-key dependence, sandbox risk, past token-leak and injection issues, and patch review controls
• What the numbers show: in research testing, it scanned 1.2 million+ commits and flagged 11,353 high-impact issues, including 792 critical findings

I’d look at this as a security agent for the command line, not a fully hands-off scanner. You still need human review, tight access controls, and a small pilot before putting it into CI.

A few points stand out right away:

• The release was quiet, which is why the Hacker News discovery changed perception
• The tool is open source, but full use still depends on OpenAI models and an API key
• It supports JSON output, hooks, MCP server setups, and SARIF export for team workflows
• The safest first step is to test it in read-only mode on a nonproduction repo

In other words, I see this release as a useful new CLI option for app-sec teams - but only if you treat it like any other code-running security tool: start small, lock it down, and verify its output.

What Codex Security CLI Includes

Open-Source Components and License Details

The release comes with a TypeScript SDK under Apache-2.0, published on npm as @openai/codex. You can install it globally with npm install -g @openai/codex. It needs Node.js v20+, Git v2.23+, 4 GB of RAM, and an OpenAI API key stored in ~/.codex/auth.json ^[1].

Some advanced features need more than the base install. For example, MCP server support also requires a container runtime such as Docker, Podman, or Nerdctl ^[8].

Core Commands and Outputs

These commands matter because they give teams a way to run scans, check findings, and automate security work right from the terminal. Codex Security is built to work like an automated security researcher: it can scan a repository, map project-specific attack paths, validate findings in a sandbox, and suggest minimal patches ^[4][6].

Shell commands:

In-session controls:

Those controls sit within the larger Codex setup rather than standing on their own.

Where Codex Security Fits in the Codex Toolset

Codex Security extends OpenAI's broader Codex software engineering agent with a security-focused workflow, while the standard Codex CLI handles coding tasks, file edits, and natural-language instructions ^[3][6]. Each project uses a .codex/ directory to manage configuration, event hooks, and agent instructions ^[8].

That shared setup keeps the security CLI aligned with the rest of the Codex toolset. In plain terms, it gives teams a common way to handle repo scanning, policy checks, and patch generation in CI.

Why the Hacker News Discovery Changed How Developers Saw This Tool

How Community Discovery Drives Tool Adoption

Once the repo showed up on Hacker News, the focus changed. People stopped talking about the release itself and started asking whether they should use it.

That thread did more than add buzz. It acted like a public gut check. Codex Security CLI was already available to ChatGPT Pro, Enterprise, Business, and Edu customers, but Hacker News put it in front of a much bigger group, fast. And when that happens, things move quickly: setup pain points show up, docs get picked apart, and early user reactions surface out in the open instead of staying buried in a quiet repo release.

What Public Discussion Brought to Light

The thread also sent developers straight into the repository. That led people to notice the tool's internal codename, Aardvark, which was first used to analyze OpenAI's own codebase ^[2][10].

Just as important, the discussion made one point harder to miss: open-source access does not mean the tool runs fully on its own. Full use still depends on OpenAI models and an API key ^[9].

It also pushed people to look more closely at security. A GitHub token leak flaw was found and reported, which led developers to review their CLI setups and rotate credentials ^[11].

That shift set up the next practical question for teams: where does this CLI belong in scanning, review, and CI workflows?

OpenAI Just Dropped Codex Security (Claude Code Couldn't Trick It)

Practical Workflows for Developers and Security Teams

Codebase Scanning and Vulnerability Review

Once discovery is done, the next step is action. This is where the CLI starts pulling its weight: scanning, validation, and patching.

The CLI scans a repository, maps attack paths across the repo, and tries to reproduce each finding inside an isolated sandbox before showing it to the team. That means reviewers get reproducible evidence instead of a vague alert ^[5][4].

During its first 30 days of research testing, the CLI scanned more than 1.2 million commits and found 792 critical issues plus 10,561 high-severity issues. It also cut false positives by 50% and reduced overreported severity findings by more than 90% ^[4][2]. In plain English, that helps reviewers spend less time chasing noise and more time looking at the small set of findings that matter most.

NETGEAR reported that the tool fit its review process and made findings easier to act on ^[4].

Policy Checks and CI Pipeline Gatekeeping

Teams that want stricter control can use the CLI to stop risky changes before they ever make it to a pull request.

The sonar-integrate command adds SonarQube MCP server support and sets up hooks in .codex/ ^[8]. From there, teams can use a UserPromptSubmit hook to block hardcoded credentials across 450+ patterns before they reach the model. They can also use a PostToolUse hook to run Agentic Analysis after each file write or patch ^[8][7]. That gives teams another check for new vulnerabilities or regressions before a pull request is opened.

Findings can also be exported in SARIF format, which makes it easier to send results into current dashboards and reporting flows.

Patch Generation, Validation, and APIMart Workflow Fit

When a finding is confirmed, the workflow moves from review to repair.

The CLI generates a minimal patch for the root cause, shows it for human review, and can turn it straight into a pull request ^[5][6]. After the fix is merged, it re-validates the change in the same isolated environment to make sure the issue is actually closed ^[5]. Internal pilots reported a 40% drop in average time to resolve vulnerabilities with this workflow ^[6].

For teams using APIMart, add the following settings to ~/.codex/config.toml:

• model_provider = "apimart"
• base_url = "https://api.apimart.ai/v1"
• wire_api = "responses" for newer versions ^[1]

That routes the Codex CLI through APIMart’s OpenAI-compatible endpoint.

How to Evaluate Adoption Risks and Next Steps

Security History and Operational Cautions

Before you plug Codex Security into CI, test the sandbox, the approval model, and the patch review flow first. That's the safe move.

There are a few rollout risks you should check up front. In early 2026, Codex Security ran into a GitHub token leak and command-injection paths that led to agent hardening work ^[11]. More recently, CVE-2026-64650 (CVSS 6.3) showed that untrusted sandbox code could trigger host-exposed tools, including secret lookups and cloud APIs, without model approval. The fix is simple: update @ai-sdk/harness-opencode to version 1.0.29 or later ^[12].

The tool analyzes a temporary copy of your code in an isolated container, and it can pull GitHub context for threat modeling and commit history. That means repository analysis, sandbox execution, and patch generation each come with their own exposure surface ^[10][13]. On top of that, large codebases may take days on the first run, though later scans on incremental changes should move faster ^[10][13].

A few basic controls help cut risk:

• Keep auth.json and config.toml locked down in ~/.codex/ and out of shared environments.
• Don't expose secrets in logs.
• Make sure any Enterprise or Edu access is scoped through the right role and group controls.
• Never let the tool merge code on its own. Treat patches as output for human review only ^[1][13].

A Practical Pilot Plan for Teams

Those controls point to the safest next move: run a narrow pilot first. Use a nonproduction repo and a small reviewer group that stays consistent from start to finish.

Treat that first pilot as a reliability test, not a race to rack up findings. In plain English, you're asking: Can we trust this thing in our workflow? Check whether sandbox validation reproduces real issues before they get flagged, whether proposed patches fit the codebase's intent and style, and whether the generated threat model matches the way your environment actually works ^[4][13].

It's also smart to benchmark the pilot against your own numbers, not published averages. Look at internal precision, review time, and escalation rate. And before you expand access, manually inspect the threat model and adjust it where needed ^[13].

Conclusion: What Matters Most About This Release

If the pilot goes well, expand access slowly.

What OpenAI quietly open-sourced here is a security-focused CLI with measurable scanning value, not some throwaway demo. It only drew broad attention after a Hacker News discovery. Even so, adoption should be deliberate. Start in read-only mode when you can, validate findings against your own risk model, and only open up more permissions after the workflow proves useful in your environment.

FAQs

Is Codex Security CLI fully open source?

Yes. The Codex CLI is fully open source, and the community can contribute to it on GitHub.

That said, the models behind it usually need an OpenAI API key, which can come with standard API costs. It also stands apart from the broader Codex Security product, which is a research preview for select enterprise and education customers.

How safe is it to run on internal code?

It’s built to be secure by default. The CLI runs in a sandbox, limits directory access, blocks system changes that aren’t allowed, and turns off network access by default to help prevent data leaks.

On first run, you can also pick an approval mode. Read Only stops any changes. Auto allows file actions only inside your working directory. Full Access is best avoided unless you don’t need manual confirmation.

What is the best way to test it first?

Start by opening Codex CLI in interactive mode so you can look around without jumping straight into changes. After installation, run codex in your project terminal.

The first time it opens, you’ll need to pick an approval level. For testing, Auto is the best pick. If you want a safer, read-only setup, use codex --mode suggest instead. That way, any changes still need your approval before they’re applied.